Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Report Center > Exporting data to a third-party SIEM tool > Running the SIEM log file download script for Forcepoint storage
Running the SIEM log file download script for Forcepoint storage
You can use the parameters described below to customize the sample download script used to download reporting logs from the cloud service for use by your SIEM tool.
Some parameters have a short form (for example, -v) and a long form (for example, --verbose). For these parameters, both options are listed.
 
Parameter
Description
-u <username>
--username
Mandatory. Defines the logon user name for connecting to the cloud service. This must be an administrator contact with Log Export permissions.
For example:
-u siem_user@example.com
-p <password>
--password
Mandatory. This is the password for the specified user name.
For example:
-p Ft2016Logs
--stream
Mandatory. This is used to determine the type of files to be downloaded. Valid values are web, email, or all.
If "all" is specified, /web and /email folders are created under the destination directory and files are downloaded to the corresponding folder.
-v
--verbose
Optional. Runs the script in verbose mode, which displays progress messages.
Verbose mode provides feedback on the script's progress, for example:
*
Downloading filelist from <host name> as <user name>
*
No files available to download
*
Downloading <file> to <file name location>
-h <hostname>
--host
Optional. Defines the host name to connect to. This is specified in the script by default, so you would only need this option if you have edited the script to remove it, or if you have been given a different URL to connect to.
For example:
-h https://sync-web.mailcontrol.com
-d <file path>
--destination
Optional. Defines the destination directory for the downloaded log files. If not specified, the files are downloaded into your current working directory.
For example:
-d /cloudweb/logs
-m
--md5sum
Optional. Checks the md5sum of each downloaded file. The MD5 hash is commonly used to verify the integrity of files and can be used to check the files before they are deleted from the server.
-l
--list-only
Optional. Displays a list of available log files without downloading them.
--proxy <proxy details>
Optional. Specifies an HTTP proxy to use if you are having difficulty connecting to the cloud service. The proxy must be in the form http://username:password@host:port
For example:
--proxy http://jsmith:Abc123@proxy_server:80
--max_download_children
Optional. Specifies the number of downloading processes to run in parallel. If not set, a single process is used. The maximum number of processes that can run in parallel is 10.
If the list-only parameter returns a large number of files not yet downloaded, set this value to 10 to allow the downloads to process those files.
--infinite_loop
Optional. When configured, the download and reformat processes are run in an infinite loop. If not set, files that become available when the script is running are not downloaded.
--man
Optional. Displays the list of parameters with their descriptions.
--help
Optional. Displays a brief description of the program's purpose.
--cfgfile
Optional. Specifies the location of a configuratoin file which can include values for the other paramters.
A configuration file might look like this:
username=admin@company.com password=password1 host=sync-web.mailcontrol.com infinite_loop=false verbose=true max_download_children=3 md5sum=false list_only=true stream=all destination=/tmp proxy=http://user2@company.com:password2@myproxy.com:8081/ pidfile=/var/tmp/ftl.pid
See Getting started with SIEM integration for additional details on setting up SIEM integration and scheduling the download.
 

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Report Center > Exporting data to a third-party SIEM tool > Running the SIEM log file download script for Forcepoint storage
Copyright 2023 Forcepoint. All rights reserved.